H
Vendor security profile
home-assistant
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical2
CISA KEV0
Public exploit6
Patch rate%14
Avg. CVSS7.3
12-month vulnerability rate
0
0
0
0
0
0
1
0
1
3
2
0
CVE KEV
CVE severity distribution
7toplam CVE
Critical2 (29%)
High3 (43%)
Medium2 (29%)
Patch and exploitation view
%14
Verified patch
%0
CISA KEV
%86
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
6Unknown
Latest vulnerabilities
5.4
CVE-2026-91129
Home Assistant: mDNS Server-Side Request Forgery
H
Patch status unknownEPSS %0
9.3
CVE-2026-91130
Home Assistant: XSS in Statistics Graph Card
H
Patch status unknownEPSS %0
7.1
CVE-2026-66061
Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution
H
Patch status unknownEPSS %0
7.1
CVE-2026-66060
Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers
H
Patch status unknownEPSS %0
4.3
CVE-2026-59717
Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
H
Patch status unknownEPSS %0
9.0
CVE-2026-64825
Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload
H
Patch verifiedEPSS %1
8.7
CVE-2021-47942
Home Assistant Community Store 1.10.0 Path Traversal Account Takeover
H
Patch status unknownEPSS %0